Migrating from Vault to Infisical

Documentation Index

Fetch the complete documentation index at: https://infisical.com/docs/llms.txt

Use this file to discover all available pages before exploring further.

• KV v1 and KV v2 secrets
• Kubernetes auth method configurations (translated to Machine Identities in Infisical)
• Kubernetes secrets engine roles (translated to Dynamic Secrets in Infisical)
• Vault policies (translated to Infisical project roles)

​

Set Up Your Vault Connection

# System endpoints - for listing namespaces, policies, mounts, and auth methods
path "sys/namespaces" {
  capabilities = ["list"]
}

path "sys/policy" {
  capabilities = ["read", "list"]
}

path "sys/policy/*" {
  capabilities = ["read"]
}

path "sys/mounts" {
  capabilities = ["read"]
}

path "sys/auth" {
  capabilities = ["read"]
}

# KV v2 secrets - for listing and reading secrets
# Replace '+' with your actual KV v2 mount paths (e.g., "secret", "kv")
path "+/metadata/*" {
  capabilities = ["list", "read"]
}

path "+/data/*" {
  capabilities = ["read"]
}

# KV v1 secrets - for listing and reading secrets
# Replace '+' with your actual KV v1 mount paths (e.g., "secret", "kv-v1")
# WARNING: This is broad - ideally specify exact mount names
path "+/*" {
  capabilities = ["list", "read"]
}

# Kubernetes auth - for reading auth configuration and roles
path "auth/+/config" {
  capabilities = ["read"]
}

path "auth/+/role" {
  capabilities = ["list"]
}

path "auth/+/role/*" {
  capabilities = ["read"]
}

# Kubernetes secrets engine - for reading secrets engine configuration and roles
path "+/config" {
  capabilities = ["read"]
}

path "+/roles" {
  capabilities = ["list"]
}

path "+/roles/*" {
  capabilities = ["read"]
}

​

Migrate Your Resources

​

Migrating KV Secrets

1. Navigate to your project and select a specific environment (e.g., Development, Production)
2. In the secrets view, click the dropdown icon (caret) next to the ”+ Add Secret” button
3. Select “Add from HashiCorp Vault”
4. In the modal, pick the App Connection (project- or organization-scoped Vault connections both appear here), then the Vault namespace, then the Secrets Engine (KV mount), and finally one or more Vault secret paths to import (for example, secret/app/prod). Keys are copied using their names from Vault.

5. Click “Import Secrets”

​

Migrating Kubernetes Auth Method

1. First, create a Machine Identity in Infisical
2. Navigate to Access Control > Machine Identities and select the identity
3. Click “Add Authentication Method” and choose Kubernetes Auth
4. In the configuration modal, click “Load from Vault”
5. In the load modal, pick the App Connection, the Vault namespace, and the Kubernetes role
6. Click “Load”

​

Migrating Kubernetes Secrets Engine Roles

1. Navigate to your project and select an environment
2. Click ”+ Add Secret” dropdown and choose “Dynamic Secret”
3. Select Kubernetes as the provider
4. Click “Load from Vault” at the top of the form
5. In the load modal, pick the App Connection, the Vault namespace, the Kubernetes secrets engine mount, and the role
6. Click “Load Configuration”

• Cluster URL and CA certificate
• Credential type (Static or Dynamic)
• Service account name or Kubernetes role settings
• Allowed namespaces
• Token TTL values
• Token audiences

​

Migrating Vault Policies

1. Navigate to your project, then go to Access Control > Roles and create or edit a role
2. In the policy configuration, click “Add from HashiCorp Vault”
3. In the modal, pick the App Connection and the Vault namespace
4. Either choose an existing policy from the dropdown or paste your own HCL policy
5. Review the automatically translated Infisical permissions
6. Make any adjustments and save

# Vault policy
path "secret/data/app/*" {
  capabilities = ["read", "list"]
}

​

One-time Bulk Import from Vault

1. Navigate to Organization Settings > External Migrations
2. Click Import and choose HCP Vault
3. Fill in the import form:
   • Gateway (optional) — route the import through a gateway if your Vault instance is private
   • Vault URL — your Vault address (e.g. https://vault.example.com)
   • Vault Namespace (optional) — leave blank for the root namespace
   • Vault Access Token — a token with read access to the KV mounts you want to import
   • Project Mapping — how Vault resources map onto Infisical projects:
     • Key Vaults — each KV mount becomes an Infisical project. A default Production environment is created per project; secret paths become folders.
     • Namespaces — each Vault namespace becomes a project; each KV mount inside it becomes an environment; secret paths become folders.
     • Custom Migration — available on request; contact sales to discuss tailored mappings.
4. Submit the form. Infisical will run the import asynchronously and email you when it finishes (or if it fails). This may take up to 10 minutes.

​

Next Steps After Migration